Data bus systems are used in a variety of technical fields. Examples include automobile and aircraft technology, wherein in particular the communication of electronic control units (ECU) is achieved using bus systems, for example, CAN (controller area network) bus.
Data bus transceivers which are able to function in partial networking (PN) comprise a decoder via which the arriving bus messages can be read and decoded in the low-power mode. For implementing the partial networking, these transceivers must be configured after applying a voltage. The configuration may comprise, for example, the identifier (ID) which identifies the content of a message, an identifier mask (IDM), a piece of information about the number of bytes in data (DLC), the data field including a check field (for example, CRC field), and other configuration bits; and defines incoming messages provided for triggering the wake-up procedure. In the low-power mode, these data remain stored as long as the supply voltage is applied (for example, via KL30B). The data bus transceiver reads the messages on the bus in the low-power mode and compares them to the stored configuration. After correct decoding, for example, in the case of CAN, the ID, IDM, and DLC data bits, as well as the CRC of the incoming CAN message, are compared to the configured data. In the case of a match (for example, according to ISO11898-6), a wake-up procedure is executed, via which the electronic control unit associated with the transceiver is put into the normal operating state. If the CAN messages are not correctly decoded, but rather are erroneous due to disturbances and/or manipulation on the bus, or due to the faulty decoder, for example, in the case of a detuned clock generator of the transceiver, an error counter is incremented. If a limit is reached, a wake-up procedure is similarly executed.
Due to external or internal disturbances, for example, alpha decay, electromagnetic interference, or degradation of the memory cells, it may occur that the configuration is changed. The probability of the occurrence of an error increases with increasing duration of the low-power state. While the data could be read out and reconfigured during normal operation, a check in the low-power mode is often not possible due to power-saving measures. Thus, the electronic control unit either cannot be woken, although a data frame has been entered which is intended for waking up, or said electronic control unit is erroneously woken up via a data frame which is not provided for this purpose. In addition, it may occur that waking up the relevant electronic control unit via the bus is no longer possible at all, because the erroneous configuration no longer matches any message configuration used in the system. Depending on the relevant system with which the electronic control unit or bus user is associated, under some circumstances, the availability of a relevant system may be reduced and/or safety-critical situations may be triggered. These faults are problematic since they are not signaled.